Cloudanix VulnDB

CVE-2025-68800

None

CVSS

—

EPSS

0.2%

Published

Jan 13, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A memory handling error in the Linux kernel for certain network switches can cause system crashes, so administrators should install the available software update.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free in mlxsw spectrum_mr due to missing mutex protection on multicast route list deletion during route replace, allowing the periodic stats update worker to access freed memory.

Why it matters to the business

Kernel instability or crashes on systems using Mellanox Spectrum switches with multicast routing, causing potential denial of service; low EPSS and no KEV status indicate limited immediate risk but kernel updates remain necessary for affected Linux distributions.

How an attack unfolds

An attacker with local privileges triggers repeated multicast route additions and replacements via fibmr events while the mlxsw_sp_mr_stats_update worker traverses the list, hitting the unprotected deletion path and causing slab-use-after-free.

How to fix it

Update the Linux kernel to a version containing commit b957366f5611bbaba03dd10ef861283347ddcc88; rebuild and deploy the fixed mlxsw_spectrum module or install the corresponding stable kernel package.

How to confirm the fix worked

Confirm the presence of mutex acquisition around list_del in mlxsw_sp_mr_route_add and absence of the KASAN report in mlxsw_sp_mr_stats_update; verify kernel git describe includes the fix commit.

Typical attack path

  1. Obtain local access to trigger FIB multicast route events
  2. Add and replace multicast routes to free list entries without mutex
  3. Allow mlxsw_sp_mr_stats_update kworker to dereference freed entry

How to detect it

Search kernel logs and dmesg for KASAN slab-use-after-free reports citing mlxsw_sp_mr_stats_update or mlxsw_spectrum; monitor for oops or panic traces involving mlxsw_sp_mr_route_add and kworker threads.

  • mlxsw_sp_mr_stats_update+0x4a5/0x540
  • BUG: KASAN: slab-use-after-free
  • mlxsw_sp_mr_route_add
  • ffff8881523c2fa8
  • kworker/.*:.* mlxsw_core

What your security team should do

  • Prioritize kernel upgrade to the fixed commit across all affected hosts
  • Disable or restrict multicast routing on mlxsw Spectrum devices where feasible until patched
  • Enable KASAN or similar memory debugging in test environments to validate the fix

The record

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not change while the driver periodically traverses it in order to update the kernel about multicast route stats that were queried from the device. One instance of list entry deletion (during route replace) was missed and it can result in a use-after-free [1]. Fix by acquiring the mutex before deleting the entry from the list and releasing it afterwards. [1] BUG: KASAN: slab-use-after-free in mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum] Read of size 8 at addr ffff8881523c2fa8 by task kworker/2:5/22043 CPU: 2 UID: 0 PID: 22043 Comm: kworker/2:5 Not tainted 6.18.0-rc1-custom-g1a3d6d7cd014 #1 PREEMPT(full) Hardware name: Mellanox Technologies Ltd. MSN2010/SA002610, BIOS 5.6.5 08/24/2017 Workqueue: mlxsw_core mlxsw_sp_mr_stats_update [mlxsw_spectrum] Call Trace: <TASK> dump_stack_lvl+0xba/0x110 print_report+0x174/0x4f5 kasan_report+0xdf/0x110 mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 29933: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 mlxsw_sp_mr_route_add+0xd8/0x4770 [mlxsw_spectrum] mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30 Freed by task 29933: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x43/0x70 kfree+0x14e/0x700 mlxsw_sp_mr_route_add+0x2dea/0x4770 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:444 [mlxsw_spectrum] mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum] process_one_work+0x9cc/0x18e0 worker_thread+0x5df/0xe40 kthread+0x3b8/0x730 ret_from_fork+0x3e9/0x560 ret_from_fork_asm+0x1a/0x30

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 5.7.0 5.10.248
Mageia:9 kernel 0 6.6.120-1.mga9
Mageia:9 kernel-linus 0 6.6.120-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.14-14.mga9
Mageia:9 kmod-xtables-addons 0 3.24-88.mga9
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-azure 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.26.1.160000.2.7
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.26.1

Related vulnerabilities